Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Recon-DNSZoneTransferReconAttempt.
Upgrade to ProDetect Unauthorized DNS Zone Transfer (AXFR) and Bulk Record Enumeration Against Authoritative Nameservers in Google Chronicle
Adversaries scoping an external attack surface frequently target the victim's authoritative nameservers directly, attempting a full DNS zone transfer (AXFR, and its incremental sibling IXFR) in the hope of finding a misconfigured 'allow-transfer any' ACL. A successful AXFR dumps every record in the zone in one response — internal hostnames, mail server (MX) and SPF/DKIM/DMARC TXT records revealing third-party SaaS relationships, service discovery (SRV) records, and sometimes internal IP addressing exposed through stale A/PTR entries — handing the adversary a ready-made map of the organization's external and semi-external footprint without a single port scan. When the transfer is refused (the common case on a correctly configured server), adversaries and OSINT/recon tooling such as dnsrecon, fierce, dnsenum, and dig-based scripts fall back to bulk enumeration: rapid, scripted queries across many record types (NS, MX, TXT, SOA, ANY) and many candidate subdomains against the authoritative server itself, rather than a passive third-party database. This detection targets that server-side behavioral signature — AXFR/IXFR requests and abnormal query-type/query-name diversity from a single external client hitting the authoritative nameserver in a short window — as observed in the nameserver's own query and transfer logs, distinct from the OSINT-tool-execution coverage on the T1590.002 technique page, which keys on endpoint process telemetry for the same tools rather than the server-side query pattern. Sandworm Team, APT41, and Magic Hound have all been documented conducting broad DNS and network-infrastructure reconnaissance ahead of infrastructure acquisition and initial-access operations, and the same fingerprint is produced just as often by legitimate DNS hygiene audits, misconfiguration scanners, and unauthorized red-team activity.
MITRE ATT&CK
- Tactic
- Reconnaissance
YARA-L Detection Query
rule dns_zone_transfer_and_bulk_enumeration {
meta:
author = "df00tech"
description = "Detects unauthorized DNS zone transfer attempts and bulk record enumeration against authoritative nameservers"
severity = "HIGH"
mitre_attack_tactic = "Reconnaissance"
mitre_attack_technique = "T1590.002"
reference = "https://attack.mitre.org/techniques/T1590/002/"
events:
$e.metadata.event_type = "NETWORK_DNS"
$e.network.dns.questions.name = $qname
$e.network.dns.questions.type = $qtype
$e.principal.ip = $client_ip
$is_axfr = re.regex($qtype, `(?i)^(axfr|ixfr|252|251)$`)
match:
$client_ip over 10m
outcome:
$total_queries = count($qname)
$unique_query_types = count_distinct($qtype)
$zone_transfer_flag = max($is_axfr)
condition:
$e and ($zone_transfer_flag or ($total_queries >= 30 and $unique_query_types >= 4))
}Chronicle YARA-L 2.0 rule matching NETWORK_DNS UDM events bucketed by client IP over a 10-minute window. Flags the group immediately if any query in the window is an AXFR/IXFR request (the $is_axfr regex match on dns.question.type, aggregated via max()); otherwise flags on the same total-query-count and query-type-cardinality thresholds used by the bulk-enumeration branch of the KQL/SPL scoring model.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate secondary/slave nameserver replication from documented secondary NS IPs
- Managed DNS or anycast providers pulling zone data via scheduled AXFR from a documented set of provider IPs
- Authorized penetration testing or DNS hygiene audits explicitly scoped to probe zone-transfer misconfiguration
Other platforms for THREAT-Recon-DNSZoneTransferReconAttempt
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate External AXFR Zone Transfer Attempt via dig
Expected signal: DNS server query/transfer log entry showing a TCP/53 session and an AXFR-type request for df00tech-zonetransfer-test.internal from the test host; if no authoritative nameserver is listening on 127.0.0.1 the request fails immediately, but the outbound TCP/53 attempt and (on a lab BIND/Windows DNS instance) the query log entry are still generated for detection validation.
- Test 2Simulate Bulk Multi-Type DNS Record Enumeration via Scripted dig Loop
Expected signal: DNS server query log records approximately 40 queries from the test host spanning 8 distinct query types (NS/MX/TXT/SOA/A/AAAA/CNAME/SRV) and 5 distinct subdomain names within a short window.
- Test 3Simulate Bulk ANY-Type Query Sweep via nslookup on Windows
Expected signal: Windows DNS Server analytic log / DnsEvents entries for 12 ANY-type queries from the test host against 12 distinct subdomain names within a short window, ingested via Azure Monitor Agent.
References (7)
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Recon-DNSZoneTransferReconAttempt — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month